The de Havilland Comet, the Square Windows That Failed at Forty Thousand Feet, and the Water Tank Investigation That Wrote Modern Aircraft Certification

The oval windows on every pressurized aircraft flying today exist because of what a team of British investigators found inside a water tank in 1954. The de Havilland Comet disasters - two aircraft lost without warning over the Mediterranean in a single year - triggered the most consequential structural investigation in commercial aviation history. The certification rules that came out of it govern every transport-category aircraft certified since.

The Aircraft That Defined the Jet Age

De Havilland Aircraft Company built the Comet as Britain’s post-war answer to American and Soviet aerospace ambitions. The aircraft first flew in July 1949, and nothing like it had carried paying passengers before. Four de Havilland Ghost turbojet engines were buried flush in the wing roots - not hung in underwing pods as would become standard - and the pressurized fuselage cruised near 40,000 feet at close to 500 miles per hour. That was roughly twice the speed of any contemporary propeller airliner.

British Overseas Airways Corporation (BOAC) received its first production Comet in early 1952. Revenue service began May 1952, on routes connecting London to Johannesburg and London to Singapore. Passengers who had spent 20-plus hours aboard piston airliners were cutting those journeys roughly in half.

For approximately 14 months, it worked.

Two Disappearances, No Warning

The first loss came in May 1953, when a BOAC Comet broke up in severe weather near Calcutta. 43 people were killed. The investigation attributed the accident to catastrophic structural loading from the storm. Modifications were made and the fleet returned to service.

On January 10, 1954, BOAC Comet G-ALYP - known to crews as Yoke Peter - departed Rome’s Ciampino airport bound for London. Shortly after climbing through 27,000 feet, it disappeared from radar over the island of Elba in the Tyrrhenian Sea. 35 people were on board. No distress call, no warning.

The fleet was grounded. After modifications and a 51-day suspension, the Comets were cleared to resume service.

On April 8, 1954, BOAC Comet G-ALYY - Yoke Yoke - departed Rome on the same route. Twenty minutes after takeoff, climbing through approximately 35,000 feet, it vanished from radar near the island of Stromboli. 21 people were on board.

The Comet fleet was grounded immediately and permanently. The certificate of airworthiness was suspended.

The Farnborough Investigation

The British government assigned the investigation to the Royal Aircraft Establishment at Farnborough, under the direction of Sir Arnold Hall. The Royal Navy conducted an extensive deep-water recovery operation around Elba, deploying trawl nets and underwater cameras across a wide search area. Approximately 70 percent of the Yoke Peter airframe was recovered - a remarkable result for a high-altitude breakup over open water.

When Hall’s team reassembled the recovered structure on a framework at Farnborough, the physical evidence pointed to a failure that initiated at the forward escape hatch and at the corner of a window cutout in the upper fuselage. The tearing in the skin was consistent with internal overpressure - the pressure vessel had failed from the inside out. The question was why a certified, inspected aircraft would fail this way in normal service.

The Water Tank Test

Hall’s team designed a test that had never been conducted at this scale for a commercial airliner. They placed an actual Comet fuselage inside an enormous tank of water, pressurized the cabin, cycled it back down, then repeated the process - thousands of times.

The choice of water over air was deliberate and critical. Compressed air stores enormous energy. If a vessel pressurized with air ruptures, all that stored energy releases in a violent explosion that destroys the evidence. Fracture initiation points are obliterated. Fragments scatter. Water is nearly incompressible - it cannot store meaningful energy the way compressed gas can. If the fuselage cracked during water testing, the crack would propagate without an explosion. Investigators could stop the test, recover the intact structure, and trace the failure precisely back to its origin.

The Comet fuselage in the tank failed after a number of cycles equivalent to roughly 3,000 flights at altitude. The recovered Yoke Peter airframe had accumulated approximately 1,300 pressurization cycles in service - well below the test failure point. But the testing made clear the structure was not holding steady below that threshold. It was degrading from the very first cycle. The failure was not a sudden cliff. It was the end of a long, invisible downslope.

Why the Windows Failed: Metal Fatigue and Stress Concentration

The failure initiated at the corners of the windows.

The Comet 1 had roughly square windows with tightly radiused corners, rather than the broad oval shapes found on every pressurized aircraft today. Each pressurization cycle placed the fuselage skin under significant tensile stress, and that stress was not distributed evenly. At any cutout in the skin - a window, a door, an escape hatch - stress concentrated at the corners. The metal at those corners was working harder than the surrounding skin with every single cycle.

A second factor compounded the problem. The rivet holes in the window frames had been made using a punch-press process rather than drilling. Punching forces material out of the path of the punch rather than removing it cleanly, creating microscopic cracks at the edge of each hole that are invisible during standard inspection. Under cyclic loading, those cracks grow slowly but steadily, eventually linking up with each other and with the stress concentration at the window corner. In a pressurized fuselage at altitude, the result is catastrophic decompression and structural failure in a fraction of a second.

This failure mode - structural failure caused by cyclic loading well below the material’s ultimate strength - is called metal fatigue. Engineers had understood the principle since the 1840s, when railway axle failures established the phenomenon clearly. But systematic application of fatigue analysis to pressurized aircraft fuselages undergoing repeated pressurization cycles had never been formally required by the certification standards governing the Comet’s design.

Those standards required static load testing: apply a load, measure the result, and if it holds to ultimate load, it passes. Static testing reveals peak strength on a given day. It reveals almost nothing about what happens when a fraction of that load is applied and removed ten thousand times.

How Farnborough Rewrote the Rules

The investigation established requirements that are now foundational to aircraft certification:

Fatigue life must be demonstrated through cyclic testing, not just static load testing
Manufacturing processes must be evaluated for their effect on fatigue crack initiation
Structural cutouts in pressurized skins must minimize stress concentration - meaning rounded corners with generous radii
Aircraft must incorporate fail-safe structural design: multiple load paths, so that if one element develops a fatigue crack and fails, the remaining structure carries the load until the damage is found and repaired

Federal Aviation Regulation Part 25 - the FAA’s airworthiness standard for transport-category aircraft - includes extensive requirements for fatigue and damage tolerance analysis that carry the direct fingerprints of this investigation. When an airworthiness directive requires inspection of a specific spar cap or frame station at a specified number of flight cycles, the conceptual framework behind that requirement was established at Farnborough in 1954.

Boeing was paying close attention. The Boeing 707, in development during the Comet accidents, was designed with oval windows from the outset, with properly radiused corners and documented fatigue testing. The 707 entered service in 1958, its structural design philosophy shaped in meaningful part by the lessons being published from Farnborough.

The Commercial Cost of Pioneering

De Havilland redesigned the Comet. The Comet 4 entered service with BOAC in October 1958 with rounded windows and a structure re-engineered with fatigue life as a primary design constraint. It was a sound aircraft.

The timing was brutal. Pan American World Airways began 707 service that same month - almost the same week. The Comet 4 was smaller and shorter-ranged than the 707. Britain had built the world’s first jet airliner and then yielded its commercial lead during the years the investigation ran.

There is a lesson in that for anyone building new technology under competitive pressure.

Why This Matters for Aviation Today

The Farnborough investigation succeeded largely because the Royal Navy could reach the seabed in the Tyrrhenian Sea and recover most of Yoke Peter. Physical evidence, preserved and recovered, is the foundation of everything we know about why aircraft fail. That is the direct line connecting the Comet recovery to the international standards governing flight data recorders and cockpit voice recorders on every aircraft flying today - devices built to survive high-impact crashes and positioned specifically to maximize the chance of post-accident recovery.

The Comet story is also the pattern for what happens when new technology outpaces the regulatory framework built to certify it. The Comet was certified under standards written for propeller aircraft. The gap between the technology and the rules was not the result of negligence or corner-cutting. It was the result of genuinely new capabilities arriving faster than the engineering community could build the knowledge base to certify them safely.

That gap is present right now. eVTOL aircraft currently in the FAA’s certification pipeline bring new powertrain architectures, new structural philosophies, and failure modes that existing standards were not written to address. The FAA is working through that problem in real time, for aircraft that will carry passengers within the decade. Whether the gap closes before or after the first accident depends on the quality of that regulatory work and on how many resources the industry and the agency bring to it.

The passengers and crew lost across the Comet accidents did not die to teach the industry anything. But the lesson exists. It is built into every oval window frame on every pressurized aircraft flying today.

Key Takeaways

Two BOAC Comets disappeared without warning in 1954 - G-ALYP (Yoke Peter) over Elba on January 10 and G-ALYY (Yoke Yoke) near Stromboli on April 8 - permanently grounding the world’s first commercial jet airliner
The Farnborough water-tank test preserved fracture evidence that would have been destroyed by an air-pressurized test, allowing investigators to trace the failure precisely to the corners of the Comet’s roughly square windows
Metal fatigue - structural failure from cyclic loading well below ultimate strength - had been understood since the 1840s but had never been formally required as a certification criterion for pressurized aircraft
The investigation established requirements for cyclic fatigue testing, fail-safe structural design, and rounded window cutouts now codified in FAA Part 25 and every equivalent international standard
The Comet pattern - new technology outrunning its certification framework - recurs with every generation of novel aircraft design, from jets in the 1950s to eVTOL aircraft entering the certification pipeline today